CVE-2021-28132

Name of the Vulnerable Software and Affected Versions: LUCY Security Awareness Software versions 4.7.x and earlier

Description: The issue allows unauthenticated remote code execution due to the Migration Tool in the Support section permitting the upload of .php files within a system.tar.gz file. The uploaded .php file becomes accessible via a public/system/static URI.

Recommendations: For versions 4.7.x and earlier, consider disabling the Migration Tool in the Support section until a patch is available to prevent the upload of malicious .php files. Restrict access to the public/system/static URI to minimize the risk of exploitation.